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Abstract 

Measurement-device-independent quantum key distribution with a finite number of decoy states 
is analyzed under finite-data-size assumption. By accounting for statistical fluctuations in param- 
eter estimation, we investigate vacuum+weak- and vacuum+two-weak-decoy-state protocols. In 
each case, we find proper operation regimes, where the performance of our system is comparable 
to the asymptotic case for which the key size and the number of decoy states approach infinity. 
Our results show that practical implementations of this scheme can be both secure and efficient. 
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I. INTRODUCTION 



Quantum key distribution (QKD) is one of the most successful applications of 

quantum information processing, which allows two distant parties, Alice and Bob, to grow 
secret keys with information-theoretic security 3H8J. Conventional security proofs of QKD 
assume certain physical models for the employed devices — source and detection units. For 



instance, the squashing model is widely assumed for the measurement {9 -111] in a standard 
security analysis 12]. Practical implementations, however, could fall short of meeting all 
requirements set by the models, hence security could be compromised in reality. In fact, 
side channels have been identified and exploited to break QKD security. These side-channel 



HQ, 



the time-shift attack 



attacks include the fake-state attack 
remapping attack [l7,[l^|, and the detector-blinding attack 



15 



19 



20]. 



161 ] . the phase- 



Several approaches have been proposed to counter the side-channel attacks. One way is 
to sufficiently characterize the behavior of the devices and analyze the security by taking 
into account all device parameters 2ll-l23|. This, however, can be difficult to implement in 
practice. A second approach that can defeat all side-channel attacks is device-independent 
QKD 24H26| . in which the security can be proven without knowing the specifications of the 



devices used. Security, in this case, is derived from nonlocal correlations by violating Bell's 
inequality 27], |28J]. In order to avoid the detection efficiency loophole 29J, however, a large 
fraction of the transmitted signals must be detected by the receiver, resulting in impractical 
requirements for the transmission efficiency (e.g., 82.8% 30j for the Clauser-Horne-Shimony- 
Holt (CHSH) inequality [23]). 

Instead of full device independence, a detection-device independent QKD scheme is pro- 
posed |3l|, l32j, in which the detection system is assumed to be untrusted. Since most of 



practical hacking strategies focus on the detection site, and the source site is relatively 
simple for characterization, such a scheme can close most loopholes in a QKD system. Un- 
fortunately, these schemes still need stringent requirements on the transmission efficiency of 
more than 50% |31| . 

Recently, Lo, Curty, and Qi {33] proposed efficient schemes that are measurement-device 
independent (MDI). Alice and Bob send some signals to a willing participant who can even 
be an eavesdropper, Eve. Eve performs a Bell-state measurement (BSM) and announces the 
result to Alice and Bob who will use this information to distill a secret key. The security is 



)ased on the idea of entanglement swapping using a BSM and the reverse EPR QKD scheme 
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The scheme is secure even if Eve intentionally makes the wrong measurement and/or 



announces the wron g in formation. Various implementation approaches to MDI-QKD have 



also been proposed 
demonstration 
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J37 



and significant efforts have been devoted to its experimental 
40l|. Recently, the first MDI-QKD experiment with decoy states is 
completed by Liu et al. [jl ). 



MDI-QKD is not completely device independent and the source devices have to be trusted 



and sufficiently characterized. When we use a co 
based MDI-QKD scheme, such as that in Ref. 



rerent source to implement a single-photon- 



331 ] . we need to estimate the single-photon 



contributions of the detection at the receiver, which can be done efficiently using decoy states 
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45]. In 33[, a security analysis is provided for the decoy-state MDI-QKD assuming 



infinitely long keys with infinitely many decoy states. In this paper, we proceed further and 
analyze the performance of decoy-state MDI-QKD when only a finite number of decoy states 
are used. Moreover, we consider statistical fluctuations caused by a finite-size key. Such an 
analysis is crucial to ensure the security of MDI-QKD in practical setups. 

We note that the effect of finite size on MDI-QKD has also been recently studied in 
an independent work by Song et al. 46[. However, they only analyzed the vacuum-l- weak- 
decoy-state protocol whereas we also analyze the vacuum+two-weak-decoy-state protocol 
here taking advantage of our general method which can easily be adapted to other decoy- 
state protocols. 

The rest of this paper is organized as follows. In Sec. [TTJ, we briefly review the MDI- 
QKD scheme with decoy states. In Sec. IHfl we investigate the QKD model for the security 
proof and simulation. In Sec. IIVI we perform a statistical fluctuation analysis on MDI-QKD 
systems, followed by numerical results in Sec. [V] We conclude the paper in Sec. [VI] with 
remarks. 



II. DECOY-STATE MDI-QKD 

The most general encoding scheme for BB84-based QKD relies on using two optical 
orthogonal modes. Here, we encode a qubit in the z basis by using two spatially separated 
modes, r and s, as shown in Fig. [TJ That is, for the z basis, the information is encoded in 
whether the photon is in mode r or s. The qubit can also be encoded into the relative phases 
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between modes r and s. Denote x basis to be the case when two relative phases {0, 7r} are 
used and y basis for {tt/2, 3tt/2}. This encoding is sufficiently general to be tailored down 



to all proposed MDI-QKD schemes. For example, in the original MDI-QKD |33j, r and s 
correspond to H and V polarizations. For BB84 encoding, the z and x basis is used (33! . We 
remark that this setup can be used to implement the six-state QKD protocol as well j^ . 
For practical pur pos es, one may consider using temporal, rather than the spatial, modes as 



proposed in 



38 



391 ] . Here, however, we are mostly concerned with statistical fluctuation 
effects due to the finite size of the key, and our results are independent of the employed setup. 
The key assumption in all MDI-QKD schemes is that the photons on which the intermediary 
BSM is performed are indistinguishable. We assume this condition is held throughout our 
analysis. 

In this paper, we assume that Alice and Bob use coherent states as their sources and use 
the z and x basis above for encoding. The MDI-QKD scheme runs as follows. 

1. Alice randomly chooses a basis from {x, z} and a bit from {0, 1}, and sends a coherent- 
state pulse with intensity randomly chosen from a predetermined set. As shown in 
Fig. [TJ if she picks the z basis, she prepares her coherent states with either H or 
V polarizations depending on the bit value. Otherwise, if she picks the x basis, she 
prepares +45-polarized signals, splits the pulse into two modes, r and s, through a 
polarizing beam splitter (PBS), and encodes the bit values into relative phases, {0, n}, 
between the two modes. Bob applies the same encoding procedure. 

2. Alice and Bob send the pulses to the relay, which can be fully controlled by Eve. Eve 
performs a partial BSM on the received pulses, as shown in Fig. [TJ Eve announces her 
detection results. She is allowed to be dishonest. 

3. Alice and Bob compare the bases used for all transmissions which include the no- 
detection events, successful BSM events, and unsuccessful BSM events. 

4. Based on Eve's announcement for each pulse, Alice and Bob keep the bit if it cor- 
responds to a successful BSM event and a compatible basis has been used. One of 
them also flips the bit value in the case of an anticorrelated BSM result (see Fig. [1]). 
They discard all other bits corresponding to the no-detection events, unsuccessful BSM 
events, and those with incompatible bases. 
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FIG. 1. (Color Online) A schematic diagram for the MDI-QKD protocol, where PBS stands for 
polarizing beam splitter and PM stands for phase modulator. In order to encode their bits in the z 
basis, Alice and Bob generate phase-randomized coherent states with either H or V polarizations 
at their sources. To encode a bit in the x or y basis, they generate +45-polarized signals at their 
encoders. A PM will introduce a relative phase shift between their reference and signal beams. 
The phase shifts are chosen from the set {0,7r} for the x basis and {-7r/2,37r/2} for the y basis. 
A partial BSM, possibly performed by an untrusted party, Eve or Charlie, on the two reference 
and the two signal modes would establish correlations between the raw key bits of Alice and Bob. 
If they both use the z basis, a click on exactly one of the r detectors and exactly one of the s 
detectors would imply anti-correlated bits shared between Alice and Bob. For x and y bases, if 
they both use the same basis, a joint click on detectors ro and so implies identical bits for Alice 
and Bob; so does a joint click on r\ and s\. A joint click on ro and s\, or, n and sq would imply 



anticorrelated bits 



38]. 



5. For each combination of Alice's intensity fi, Bob's intensity u, and basis w = x, z, they 
test the error rate E™ v of the retained bits, and compute the gain Q™ by counting the 
number of successful BSM events among all transmissions (including the no-detection 
events, successful BSM events, and unsuccessful BSM events) when Alice and Bob 
used compatible bases. Thus, it is necessary for Alice and Bob to compare their bases 
even for bits that have not resulted in a successful BSM and are to be discarded. 



6. Alice and Bob estimate the yield Y x \ and the phase error rate e\ x for the fraction of 
signals in which Alice has a single photon and Bob has a single photon, based on 



the analysis in Sec. IIVI With this parameter estimation, Alice and Bob perform error 
correction and privacy amplification to distill a final secret key. 

The analysis in the last step is the main focus of this work. 
III. MODEL 

The notations and definitions used in the model are listed below. 

• Alice and Bob each use coherent states to implement decoy-state MDI-QKD. In addi- 
tion to the signal state, different intensities will be used for a number of decoy states. 
In this section, we denote the mean number of photons in a certain pulse sent by 
Alice and Bob, respectively, by \i and v. In subsequent sections, we introduce a more 
detailed notation as needed for decoy states. 

• We use the term "i-photon channel" when a Fock state with % photons is used as 
information carrier. We denote the joint channel when Alice uses an i-photon channel 
and Bob uses a j-photon channel by iWj channel, where i, j = 0,1,2, ... . When there 
is no ambiguity, we use \x l±J v channel to represent the case when Alice and Bob send 
out coherent states with intensities /i and v, respectively. 

• The overall gain Q™ is defined as the probability of obtaining a successful partial 
BSM when Alice and Bob use the [i l±l v channel and the w basis, where w = x,z. The 
quantum bit error rate (QBER) E™ v is the corresponding error probability. 

• The yield Y£j is the probability to obtain a successful BSM when Alice and Bob use 
the i l±l j channel and the w basis, where w = x,z, and e^- is the corresponding error 
probability. The gain is defined as the probability that Alice and Bob use the i l±l j 
channel and obtain a successful partial BSM. 

• Denote the transmittance of the channel between Alice (Bob) and the relay to be 7] a 
(r] b ). Denote the dark count of each detector by pd- 

• We assume the phase modulator (PM) and PBS devices at Alice and Bob are perfect. 
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A. Photon-number channel model 



When the phases of the coherent states used by Alice and Bob are randomized, the 



quantum channel can be modeled as a photon- number channel model 43]. That is, Alice 
and Bob randomly choose quantum channels (with a Poisson distribution) with different 
Fock states. Thus, the gain and QBER is composed of all the possible i W j-channels, 

tl w = - — p'^v." 

W (1) 

P» f)W _ ST^ £±J_ -V-v wyw 

»>i 

where w = x, 2. 

In the security proof, we assume that Eve has a full control of and efj ranging from 
to 1. The purpose of using decoy states is to estimate Ygj and e^-, with a particular interest 
in Y^l and e™ x as only the 1 t±J 1 channel contributes to the secret key bits. The gain and 
QBER, Q™ v and E™ u , on the other hand, are observables for Alice and Bob and are used for 
the above estimation. 



B. Asymptotic case 

In this section, we present the expected values for the parameters of interest if an infinitely 
long key is used. These analytical results can be obtained if we assume that the system is 
operating under normal conditions. We emphasize that the results of this simulation model 
can only be used for simulation purposes, but not for the security proof. For the post- 
measurement processing of a real QKD experiment, the key rate and the actual key are 
derived from the measurement outcomes, which also include possible Eve's intervention. 



Here, we directly take the results from the Appendixes of Ref. 38]. The observables we 
need to use for the simulation are the following gains and QBERs: 



Q% = 2y 2 [l + 2y 2 - 4yI Q (x) + I (2x)], 
E; u Q*„ = e Q% - 2(e - e d )y 2 [I (2x) - 1], 



and 



Q]w — Qc + Qe, 

= e ^Qc + (1 - e d )Q E , (3) 



where 



Qc = 2(1 - p d ) 2 e~»'l 2 [l - (1 - p d )e-w/ 2 ] [l - (1 - ^) e ^^/ 2 ] , 

Q s = 2p d (l -p d ) 2 e^'l 2 [I (2x) - (l-p d )e-^ 2 ]. (4) 

In the above equations, Iq(x) is the modified Bessel function of the first kind, e d represents 
the misalignment-error probability, eo = 1/2, and 



x = y/r] a fir] b u/2, 
y = (l-p d )e-^\ 
A*' = + VbV- 

We also need the gain of single-photon states, Qf x , w = x,z, given by 

Q w n = nue-^Y£. 

Without Eve's intervention, the yield and error rate of the 1 tfcl 1 channel are given by 



VaVb 

L 2 



+ (2rj a + 2rj b - 3rj a rj b )p d + 4(1 - r/ a )(l - r) b )p 2 a 



en^ii = eoY& - (e - e d )(l - p d ) 



2 VaVb 



p z yz 
e ll 2 11 



e Y 1 z 1 -(e -e d )(l- Pd ) 2 (l-2 Pa 



VaVb 



(5) 



(6) 



(7) 



which will be used for the simulation of the asymptotic case. 



IV. POST PROCESSING 



A. Key rate 



The key rate is given by [33|, |43] 



R>Q z n [l-H(e x u ))-I e 



(8) 



he = Q%fH(E* v ), 

where I ec is the cost of error correction, / is the error correction efficiency, and H(e) = 
— e log 2 (e) — (1 — e) log 2 (l — e) is the binary Shannon entropy function. We assume that the 
final key is extracted from the data measured in the z basis. Note that, for single-photon 
states, the phase error probability in the z basis is the bit error probability in the x basis, 
ef l5 since single photons form a basis-independent source 



48 . 
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B. Parameter estimation 



The post-measurement processing of MDI-QKD includes the two conventional stages of 
error correction and privacy amplification. Error correction only depends on the directly 
observable error rate, E z . Thus, the term J ec , in the key rate formula of Eq. (jSJ), is fixed. 
For privacy amplification, one needs to estimate the parameters of the 1 l±l 1-channel, Q\ x 
and efi, with decoy states. Thus, the key point of the parameter estimation in this stage 
is to estimate the privacy amplification term, i.e., the first term on the right-hand side of 
Eq. (JED. 

Assume that Alice uses m a phase-randomized coherent states with intensities /i , fJ>i, ■ ■ ■ , Hm a -i, 
represents one srgnal and m ,-l decorates, and Bob o S e s ,n b densities 
Our objective is to solve the following [49]: 

mm (9) 

ij ' ij 

subject to 

w \< (io) 

rpw f)W _ rk_J -liu-m wyw 

i,j 

for k = 0, 1, . . . , m a — 1, I = 0, 1, . . . , — 1 and w = x,z. The number of linear constraints 
in Y^- and e^Yy is Am a mb. 



X 

11 



In order to find the minimum in Eq. ([9]), we lower bound Y* x and upper bound e 
separately [|3(3] . Both these problems can be solved using linear programming, and that will 
provide us with a lower bound on the optimal value that one can find by directly solving 
the nonlinear minimization problem in Eq. ([9]). Note that, even in our simplified approach, 
one must deal with an infinite number of unknowns in Y^ and e^-, i, j — 0, 1, 2, . . . . In our 
numerical analysis, we take an additional simplifying step and drop terms of higher orders 
in Eq. (ITU1) . Because of the Poisson-distributed coefficients of Y^f and efp in Eq. (ITU1) . these 
terms decrease exponentially by increasing i and j. From our numerical simulations, we find 
that the effect of terms with i,j>7 on the parameter estimation is negligible. To further 
verify this analytically, note that the sum of the dropped terms of i,j>k in Eq. ( flOl) is 



upper bounded by r(fi,k) := 1 — (Yli=o % e M ) 2 when considering Y£- = 1 and assuming 
that /i = fi k = Fig. [2] shows r(//, k) for three nominal values of \x and k — 6, . . . , 11. It 



turns out that the neglected terms have insignificant impact on the values of and e^Y"^ 
that we obtain in our simulations in Sec. [V] see Tables [TV] and PVT . 
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FIG. 2. (Color Online) Upper bounds on the dropped terms in Eq. (I10p . It can be seen that the 
effect of dropping higher order terms is negligible when the number of leading terms kept, k, is not 
too small. 



We follow the statistical fluctuation analysis proposed in Ref. |44|. Then, the equalities 
in Eq. (fTUj) becomes inequalities, 



Q 



Ar)<£ 



h3 



(ii) 



V-3 



eq)i 



where if the left hand side of the inequality is negative, we replace it with 0. The variables, 
Q™ kUl and E™ kU[ are measurement outcomes. That is, they are rates instead of probabilities. 
The fluctuation ratio (3 q and (3 eq can be evaluated by 

n a 



fieq 



(12) 



Q w 



where N™ is the number of pulses, in the w basis, sent out by Alice and Bob when they use 
intensities fi^ and ui, respectively; n a is the number of standard deviations one chooses for 
statistical fluctuation analysis. In other words, N™ kUi Q™ kUi is the number of successful partial 
BSMs when Alice and Bob use intensities ^ and z/;, respectively, and N™ E™ Q™ is the 



corresponding error count. If we follow the Gaussian assumption made in 



44|, the number 
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of standard deviations, n a , will be directly related to the failure probability of this security 
analysis. For example, when used later, it will introduce a failure probability of 

5.73 x 1(T 7 . 



V. SIMULATION 

For simplicity, we assume that Alice and Bob send the same number of pulses for all fi W v 
channels, denoted by N data . I n the following simulations, the parameters of the experimental 
setup are listed in Table HI 



e-d Pd f N data 
1.5% 3 x 1(T 6 1.16 2 x 10 10 

TABLE I. List of experimental parameters used in numerical results: is the misalignment 
probability; p d is the background count rate per detector; / is the error correction inefficiency; 
Ndata is the number of pulses sent by Alice and Bob for each pair of intensities. 

In the simulation, we absorb the detection loss into channel losses. Note that with the 
current development in high-speed QKD systems [5ll-l53|. N da ta = 2 x 10 10 pulses can be 



transmitted in seconds. We assume that Alice and Bob pick n a standard deviations for the 
statistical fluctuation analysis, which is determined by the allowable failure probability for 
the system. 



A. Vacuum+weak-decoy-state protocol 



We consider that Alice and Bob run the vacuum+weak-decoy-state protocol 44| and they 
choose the same intensities for the coherent states. Let us assume a typical set of intensities: 
{0, 0.1, 0.5}. Note that we assume N data = 2 x 10 10 for each \i W v channel. Thus, the total 
number of pulses sent by Alice and Bob is 18 x 10 10 . 

For each of the nine /ittlz/ channels, Alice and Bob can obtain a set of linear inequalities, in 
the form of Eq. (fTTj) . for gains and QBERs. As noted before, we neglect terms with i, j > 7, 
and find the lower bound on and the upper bound on e\ x using linear programming. 

In order to obtain a sense of the magnitude of the parameter values, we calculate the 
gains and QBERs, at r\ a = r\ h = 0.1, using Eqs. (j2J) and (j3J) for the x and z basis. The gain 
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values are listed in Table [TTJ The QBER of the case when either party chooses the vacuum 





z-basis 


x-basis 


Bob/ Alice 


fi = Q 




n = 0.1 




H = 0.5 


/x = 




fx = 0.1 


H = 0.5 


v = 


3.6000 x 10- 


11 


5.9587 x 10- 


-8 


2.8900 x 10" 7 


3.5999 x 10- 


ii 


2.4873 x lO" 5 


6.0229 x 10~ 4 


v = 0.1 


5.9587 x 10" 


-8 


4.9374 x 10" 


-5 


2.3935 x 10~ 4 


2.4873 x 10" 


-5 


9.8876 x lO" 5 


8.6437 x lO" 4 


v = 0.5 


2.8900 x 10" 


-7 


2.3935 x 10" 


-1 


1.1603 x 10" 3 


6.0229 x lO- 


-1 


8.6437 x 10~ 4 


2.3495 x lO- 3 



TABLE II. Simulation values of the gain, <3™„, w = x, z, for the vacuum+ weak-decoy-state protocol, 
evaluated using Eqs. ((2j) and ([3]). It is assumed that rj a = rjb = 0.1. 



decoy state is 1 /2 and that of the remaining four nontrivial cases is shown in Table IHIl for 
the x and z basis. Note that the QBER in the z basis is reasonably close to e& as expected 
from Eqs. ([3]) and (j7|). The QBER in the x basis, on the other handj_is larger than 25%, 



which is mainly caused by false triggering of multiphoton states 
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. This is the key 



reason why the final key in Eq. (jSJ) should be only extracted from the z basis. 





z-basis 


x-basis 


Bob/ Alice 


H = 0.1 /j = 0.5 


/x = 0.1 /i = 0.5 


v = 0.1 
v = 0.5 


1.6164% 1.5700% 
1.5700% 1.5236% 


25.7184% 36.3867% 
36.3867% 25.4516% 



TABLE III. Simulation values of QBER, E™ v , 
from Eqs. © and ©. 



x, z, for different intensity values evaluated 



In practice, Q™ and E™, similar to those in Tables ILT1 and [ITT] are derived from the raw 
data obtained in the experiment. The task of the security analysis, which is the main focus 
of this work, is to determine the final secure key rate for such sets of data. Following the 
analysis given in Sec. IIV B| here we minimize Yyy and maximize e\ x subject to constraints 
of Eq. (Ilip . by assuming that the values listed in Tables HT1 and [TTT1 are, respectively, the 
measured gain and QBER in a certain experiment. 

Table |IV] provides lower and upper bounds on these parameters, obtained by solving the 
corresponding linear-programming problems, and compared them with the expected values 
from the simulation results of Eq. (J7|). From Table IIVt one can see that the parameter 
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estimations in the x basis is worse than those in the z basis. This is because multiphoton 
terms contribute more to the gains and QBERs in the x basis than in the z basis. 







w = z 


w = X 


Parameters 


Asymptotic value 


Lower bound Upper bound 


Lower bound Upper bound 


VW 
Ml 

e ll 


5.0011 x 10~ 3 
1.5108% 


4.6043 x 10~ 3 6.0286 x 10~ 3 
0.9556% 2.1341% 


4.1343 x 10~ 3 6.6334 x 10~ 3 
10.2126% 



TABLE IV. Lower and upper bounds on and efi in both bases, compared to asymptotic values. 
In our statistical fluctuation analysis, five standard deviations are taken into consideration. 

Substituting the parameter estimations from Table IIVI the lower bound of Y* x and the 
upper bound of ef 1} into Eq. (jSJ), one can calculate the key rate to be 6.89 x 10 -5 bits/pulse. 
Similarly, one can evaluate the dependence of the key rate on channel transmittance, as 
shown in Fig. |3j One can see that even by including statistical fluctuations the key rate 
decreases linearly with channel loss before the cut-off regime. In the low-loss regime, the 
vacuum+weak-decoy-state protocol performs almost as well as the asymptotic case. 
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FIG. 3. Key rate versus channel transmittance using vacuum+weak decoy-state method for MDI- 
QKD. 
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As shown in Fig. [3j with n a = 5 standard deviations, the maximum tolerable transmission 
loss is almost 30 dB less than that of the asymptotic case. Even if we do not take the 
statistical fluctuations (n a = 0) into account, there is still a gap between the two cases. 
Thus, there is big room for further improvement. In the next simulation, we will consider 
three decoy states and show that further improvements can be made when more decoy states 
are applied. 

B. Vacuum+two- weak-decoy-state protocol 

In order to give a better estimation of and e^ 1; one can use more than two decoy 
states. Let us assume that Alice and Bob use four coherent states {0, 0.1, 0.2, 0.5} and that 
we use Ndata = 2 x 10 10 for each \i l±l v channel. Thus, the total number of pulses sent by 
Alice and Bob is 32 x 10 10 , corresponding to 16 channels. Given that by adding an extra 
decoy state on each side we can better estimate channel parameters, the key rate is expected 
to be no less than the one in Sec. IV Al 

Similar to the previous section, we take r\ a = rj b = 0.1 as an example to see how accurate 
the parameter estimation is. The bounds of Y* x and e\ x in both bases, compared to the 
asymptotic case, are listed in Table |YJ Again, the parameter estimations in the x basis is 
worse than those in the z basis, due to the multiphoton terms. 







w - 


= z 


w = X 


Parameters 


Asymptotic value 


Lower bound 


Upper bound 


Lower bound Upper bound 


Ml 


5.0011 x 10~ 3 


4.7058 x 10~ 3 


5.2377 x lO- 3 


4.3734 x 10~ 3 5.5640 x 10~ 3 


„w 
e ll 


1.5108% 


1.1103% 


2.0409% 


7.7954% 



TABLE V. Lower and upper bounds on and ef^ in both bases, compared to asymptotic values. 
In our statistical fluctuation analysis, five standard deviations are taken into consideration. 

Similar to the vacuum+ weak-decoy-state case, one can calculate the key rate to be 1.09 x 
10~ 4 bits/pulse by substituting the parameter estimations from Table IV] the lower bound 
of and the upper bound of ef 1; into Eq. (jSJ). According to Table |VJ our parameter 
estimation has improved when more decoy states (in extra pulses) are applied, as compared 
to the previous case in Table [TV] 
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FIG. 4. Key rate versus channel transmittance using vacuum+two- weak-decoy-state method for 
MDI-QKD. 



The dependence of the key rate on the channel transmittance is shown in Fig. |H One 
can see that the gap between the finite-size case and the asymptotic case is smaller than the 
one shown in Fig. |3j In the case of n a = 0, the vacuum+two-weak-decoy-state protocol is 
very close to the asymptotic case. This is different from regular decoy-state protocol, where 
two decoy states are proven to be sufficient for practical usage 44]. 



VI. CONCLUSIONS 

We showed that MDI-QKD is a highly practical scheme even when the statistical fluctu- 
ations are accounted for. In the low-loss regime, with only two or three decoy states, the 
performance of MDI-QKD with statistical fluctuations is close to that of the asymptotic 
case. At higher values of loss, using three decoy states would be recommended. We remark 
that our analysis is quite general and is applicable to different MDI-QKD implementations 
such as those based on phase encoding and/or polarization encoding as well as those those 
based on the BB84 protocol or the six-state protocol. 
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